Learn Cloud Native

Give every GitHub pull request its own lightweight Kubernetes sandbox, run tests against the PR's code inside the cluster, and isolate schema changes with disposable Neon database branches.

Configure agentgateway for tool allowlists, release service accounts, public and admin access, read-only assistants, federated servers, and ExtMCP guardrails.

An AI agent is a machine that holds your credentials and can spend money.

Coding agents are quite good at writing code now.

Most projects don't have a configuration system — they have a pile: a .env file, a Makefile, a CI workflow, and secrets in a fourth place, none of it validated and all of it slowly drifting apart. cuenv replaces that pile with a single typed env.cue writt…

Compare the top cloud-native certifications in 2026 — CKA, CKAD, CKS, KCNA, KCSA, Istio, Prometheus, and more: what each costs, where to take them, and the best learning resources to prepare.

Preflight is a VSCode extension that reviews your code changes and generates PR summaries using AI — all before your code leaves your machine.

What is an AI agent actually made of?

This short post explains how to integrate Google Drive into your Next.js application.

Learn how to streamline your deployment process using Fly.io, GitHub Actions, and Dagger.

While developing microservices locally is possible, running and testing them in a production-like Kubernetes environment is complex.

CNCF announced a new certification targeting Istio.

Set up a global rate limiter in Istio using Envoy's rate limit service: deploy the service, configure descriptors for real-world scenarios, and monitor rate limits with Prometheus and Grafana.

I share a quick look into my history with Istio and how I've seen it evolve from an incubating project to a graduated one.

Hands-on Cilium network policy tutorial: write ingress and egress NetworkPolicies, add Layer 7 (HTTP-aware) rules with CiliumNetworkPolicy, and visualize allowed and denied flows with Hubble.

Deep dive into Kubernetes networking: how kube-proxy programs iptables rules, pod-to-pod and pod-to-service traffic, the role of CNI and kubelet, and iptables vs.

Complete guide to Istio ServiceEntry: add external services to the mesh, choose between DNS, STATIC, and NONE resolution, configure endpoints for static IPs, and fix 502 errors with REGISTRY_ONLY mode.

Yes, you can apply an Istio DestinationRule to all workloads in the mesh.

Step-by-step guide to local rate limiting in Istio: how Envoy token buckets work, configuring per-workload limits with EnvoyFilter, and rate limiting at the ingress and egress gateways.

This article explains how to expose custom ports on the Istio ingress and how can you use the same host name, but different port, and route the traffic to two (or more) Kubernetes services.

Install Portainer on Kubernetes and manage containers from a web UI: step-by-step installation with Helm, creating namespaces, and deploying your first app — no kubectl required.

The challenge that I'll explore today is that you have an HTTP service exposed through Traefik Proxy and you want to deal with the HTTPS burden (TLS termination), leaving your pristine service unspoiled by mundane technical details.

A collection of more than 20 useful and practical Kubernetes CLI tips from the Kubernetes community.

SSL certificates are a must these days.

This article contains a set of 10 best practices for Argo Workflows, ArgoCD, and Argo Rollouts.

本文将向您展示如何在 OCI Ampere A1 上准备和启动计算密集的 AI 应用程序。

In this article, I will demonstrate easy steps of preparing and launching compute-intensive AI applications on OCI Ampere A1 shape to take advantage of the best-in-class AI inference performance of Ampere Altra processor and Ampere Inference Optimizer (AI…

GitOps makes configuration management seamless by creating a single source of truth for configuration changes so that changes can be transparent, validated, and low-risk.

Run Firebase locally with Next.js: set up the Firebase Emulator Suite for Auth and Firestore, connect your Next.js app in development, and stop touching production data while you build.

In this article, I'll take you on a journey of setting up a free-for-life virtual machine instance running on OCI.

kwatch is an open-source tool that detects crashes in Kubernetes Pods in real-time and sends the notifications to supported backends.

In this blog post, we will discuss continuous profiling and then instrument a couple of microservices running on Kubernetes using an open-source tool called Pyroscope.

Monitoring with cAdvisor allows you to gather information about individual Docker containers. cAdvisor runs as a daemon and collects the information about running containers, crunches the data, and exports it to your backend system of choice (Prometheus,…

You've created your Kubernetes cluster and now it's time to put it to use.

In this first lab in the series of Kubernetes labs, we'll learn how to create a Kubernetes cluster in Google Cloud

The concept of hooks is well-known in the tech world.

Have you ever said "THIS WORKED YESTERDAY!!".

GetIstio CLI was released this week.

In this post, you'll learn how to expose multiple Kubernetes services running inside your cluster using Istio' Gateway and VirtualService resources.

What happens to your data when Kubernetes reschedules a Pod?

I needed a way to send a notification to a Slack channel, whenever I push new versions of Docker images to the registry.

Using the NetworkPolicy resource, you can control the traffic flow for your applications in the cluster, at the IP address level or port level (OSI layer 3 or 4).

The ambassador container pattern aims to hide the primary container's complexity and provide a unified interface through which the primary container can access services outside of the Pod.

Start Kubernetes will teach you everything you need to know to use Kubernetes effectively.

The sidecar container aims to add or augment an existing container's functionality without changing the container.

Init containers allow you to separate your application from the initialization logic and provide a way to run the initialization tasks such as setting up permissions, database schemas, or seeding data for the main application, etc.

Istio allows you to enable or disable different components, as well as tweak the configuration for them.

The strangler pattern is useful for scenarios where you can intercept the calls at the edge of your monolithic application.

The strangler pattern is used in scenarios when you're migrating from monolithic systems by extracting pieces of functionality and moving that functionality into new services.

One part of the Start Kubernetes course I am working on (in addition to the book and videos) is the interactive labs.